Winston Howes bd274564e1 Add opt-in credential masking for proxied sandboxed sessions (#52302) ...

## What changed

- Add the disabled-by-default `features.credential_masking` flag to enable credential brokerage through an already enabled network proxy, retaining custom credential providers and managed configuration precedence.
- Prevent project configuration from overriding credential masking and apply existing credential-broker protections to project shell settings when masking is enabled.
- Keep brokerage inactive when the proxy is disabled. Warn at startup and after permission-profile changes when masking is inactive because sandboxing or the proxy is disabled, or provider environment keys conflict.

## Testing

Add coverage for configuration precedence, project protections in both configuration loaders, permission-profile transitions, inactive-masking warnings, and shell snapshot masking of built-in and custom credentials.

GitOrigin-RevId: 4bcb293356e8c1524bdaa4f1b95cbc1e935a5271

2026-10-08 22:27:00 +00:00

..

src

Add opt-in credential masking for proxied sandboxed sessions (#52302)

2026-10-08 22:27:00 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Support remote agent message boards in multi-agent sessions (#49267)

2026-09-29 13:52:04 +00:00